This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present disclosure that are described and/or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present disclosure. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art.
Passwords are ubiquitous in today's computer systems, for example to authenticate a user for log-on. In its generic definition, a password is constituted of a succession of symbols taken within a predefined alphabet (for example: 4 numerical values for PIN code). A password is generally stronger the longer it is, in particular if the password is a mixture of uppercase and lowercase letters, numbers, and characters such as &, “ and #. However, a more complicated password is generally more complicated to type properly, especially since the typed characters do not appear on the screen. In addition, since users may be obliged to input the passwords many times a day, the passwords are often typed very quickly. It is thus not surprising that an input password can contain typing errors. Moreover touchscreen-based devices like smartphones and tablets use virtual keyboards to enter some text, including passwords. With this type of input, typing errors can be quite frequent.
The prior art comprises a number of solutions that provide passwords that are resistant to typing errors.
The tool Password Variator builds a file with all possible variations on the password, emulating up to three typos such as missed characters, duplicated characters, extra characters, wrong order and wrong case. Andrew Mehler and Steven Skiena provide a different solution in Improving Usability Through Password-Corrective Hashing. Their solution processes the password before hashing—for example by sorting the input password alphabetically to correct transpositions—so that it is likely that a slightly misspelt password hashes to the same hash value as the correct password. It is evident that such multiplication of “acceptable” passwords drastically reduces the strength of the password since many different passwords hash to the same value, including passwords that differ from much more than one or two typos.
The solutions in U.S. Pat. No. 7,373,516 and JP 2005-208763 compare an input password with a stored password in the “password space,” i.e. in the clear, to determine if the former is “similar” to the latter. However, since these solutions require a comparison of the plaintext versions of the password, they cannot be used in real systems where storing the password in clear is generally unacceptable for obvious security reasons. Generally, authentication is handled by a server that stores a hashed version of the password, to be compared with a hashed version of the password proposal typed by the user. This is to make stealing of the passwords file less valuable.
JP 2007-114976 teaches a device, such as a PC, that among other things provides the function of keeping a count of the number of times a mistyped password is input and storing a mistyped password as an acceptable password when the number of times is sufficiently large, e.g. ten times. The skilled person will appreciate that the solution is insecure since there does not appear to be any control of the addition of the mistyped passwords; when a wrong password has been input ten times, it is stored as an acceptable password, which means that a hacker only needs to input a password ten times to have it accepted.
It can therefore be appreciated that there is a need for a solution that can allow an authentication system to allow mistyped passwords without having the drawbacks of the prior art solutions. The present disclosure provides such a solution.